# Forming an Elasticsearch cluster **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [December 14, 2025, 1:04pm UTC](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041 "2025-12-14T13:04:37Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![SamehSaeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samehsaeed/32/145262_2.png) [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Post date:** [December 14, 2025, 1:04pm UTC](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041/1 "2025-12-14T13:04:37Z")
Hello, I’m trying to add a second node to my ES cluster but I’m facing issues with SSL handshake. ```auto [2025-12-14T15:38:54,881][WARN][o.e.t.TcpTransport] [SCPRLUWS05] exception caught on transport layer [Netty4TcpChannel{localAddress=/:56786, remoteAddress=/:9300, profile=default}], closing connectionio.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: (certificate_unknown) Received fatal alert: certificate_unknown at io.netty.codec@4.1.118.Final/io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500) at io.netty.codec@4.1.118.Final/io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) See logs for more details. ``` I tried using same keystore / truststore for both http & ssl (both servers are under the same certificate) That didnt work and i got the above error. 2nd Attempt : I tried to use another server with it’s own keystore, changed truststore to certificate\_authorities and added the root\_CA.crt file and still got the same error. (EDIT : root\_CA is the same for both servers) ELK version : 9.0.3 First node OS : Windows Second node OS : Linux First node config : ```auto http.host: 0.0.0.0 http.port: 9200 xpack.security.enabled: true #xpack.security.transport.ssl.enabled: true xpack.security.enrollment.enabled: true xpack.security.http.ssl: enabled: true verification_mode: certificate keystore.path: " **** /keystore2.p12" truststore.path: " **** /truststore.p12" xpack.security.transport.ssl: enabled: true verification_mode: certificate keystore.path: " **** /keystore2.p12" certificate_authorities: " **** /ROOT_CA.crt" network.host: 0.0.0.0 cluster.name: ES_CLUSTER cluster.initial_master_nodes: [" ****05", "***** 06"] node.name: **** 05 discovery.seed_hosts: ****.94 ****.95 action.auto_create_index: true http.max_content_length: 500mb ingest.geoip.downloader.enabled: false ``` Second Node config : ```auto action.destructive_requires_name: false http.host: 0.0.0.0 http.port: 9200 xpack.security.enabled: true #xpack.security.transport.ssl.enabled: true xpack.security.enrollment.enabled: true xpack.security.http.ssl: enabled: true verification_mode: certificate keystore.path: " ***/**** _keystore.p12" truststore.path: " **** _truststore.p12" xpack.security.transport.ssl: enabled: true verification_mode: certificate keystore.path: " ****/**** _keystore.p12" certificate_authorities: " **** /ROOT_CA.crt" network.host: 0.0.0.0 cluster.name: ES_CLUSTER cluster.initial_master_nodes: [" ****05", "**** 05"] node.name: SCPRLUWS05 discovery.seed_hosts: ****.94 ****.84 action.auto_create_index: true http.max_content_length: 500mb ``` ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [December 14, 2025, 2:19pm UTC](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041/2 "2025-12-14T14:19:42Z")
> [@SamehSaeed](#): > > I tried using same keystore / truststore for both http & ssl (both servers are under the same certificate) Yes that’s almost certainly incorrect - see [these docs](https://www.elastic.co/docs/deploy-manage/security/external-ca-transport#transport-certificates-vs.-http-certificates) for further information, particularly: > In most cases, you should not use the same certificate for both HTTP and transport connections. * * * > [@SamehSaeed](#): > > I tried to use another server with it’s own keystore, changed truststore to certificate\_authorities and added the root\_CA.crt file and still got the same error. If it’s really the same `certificate_unknown` error then I’d guess you’re using different CAs for the two nodes. Typically you’d want to use the same CA for both but you can technically use a different CA as long as each node trusts the other node’s CA root cert. You must also check that the keystores you’re supplying actually contain certificates issued by the root CA, not just keys. ---
**Author:** ![SamehSaeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samehsaeed/32/145262_2.png) [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Post date:** [December 16, 2025, 7:13am UTC](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041/3 "2025-12-16T07:13:48Z")
Hello @DavidTurner , Thank you for your reply, sorry for not clarifying earlier but I’m actually using same CA for both servers (this is the CA of the organization) and both keystores have the certificate chain which follows up to the same Root\_CA but I’m still getting the same error. But according to the URL you have shared this is not the best practice and I should use a different CA for the Elasticsearch cluster. Also, the certificates for HTTP and transport should be different, I will try that. Thanks again, this was really helpful! ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [December 16, 2025, 7:57am UTC](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041/4 "2025-12-16T07:57:43Z")
> [@SamehSaeed](#): > > But according to the URL you have shared this is not the best practice and I should use a different CA for the Elasticsearch cluster. Also, the certificates for HTTP and transport should be different, I will try that. That’s true, but hmm it doesn’t really explain a `certificate_unknown` error.